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IN THE DISTRICT COURT OF THE UNITED STATES 
FOR THE DISTRICT OF SOUTH CAROLINA 
CHARLESTON DIVISION 

UNITED STATES OF AMERICA ) CR. NO. C f ' Q / 

) 

v. ) 18U.S.C. § 1343 

) 18 U.S.C. § 981(a)(1)(C) 

AMIR GOLESTAN, ) 28 U.S.C. § 2461(c) 

MICFO, LLC ) 

INDICTMENT 


COUNTS 1-20 

Wire Fraud 

THE GRAND JURY CHARGES: 

BACKGROUND 

1. At all times relevant to this Indictment: 

a. An Internet Protocol (IP) address is a numerical label assigned to each 
device connected to a computer network that uses the Internet Protocol, or the Internet, 
for communication. IP addresses serve two basic functions - host or network 
identification, and location addressing. 

b. The American Registry for Internet Numbers (ARIN) is a nonprofit 
organization that administers IP addresses. ARIN is a Regional Internet Registry (RIR) 
and component of the Internet Assigned Numbers Authority (IANA). The IANA 
delegates Internet resources to RIRs, who in turn follow regional policies to delegate 
resources to their customers. These customers include, but are not limited to internet 
service providers and end-user organizations who utilize IP addresses in their 
businesses or enterprises. ARIN is one of five RIRs, and is the RIR for the United 
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States, Canada and many Caribbean and North Atlantic islands. Part of ARIN’s 
responsibilities includes allocating IP resources, specifically the allocation and 
assignment of IPv4 and IPv6 addresses. ARIN, and its other regional counterparts, are 
critical to maintaining records and ultimately determining who is responsible for a 
given IP address. They are also critical to maintaining the Internet, and ensuring that 
an IP address is not used by multiple networks, a conflict that would result in either no 
Internet service, or unreliable Internet service. 

c. IP uniqueness was first established by the U.S. government. Prior to 1997, 
the National Science Foundation (NSF) was responsible for IP number allocation and 
registration. In 1997, the Government approved the transfer of its duties and 
responsibilities from NSF to ARIN. Thus, ARIN inherited all the duties and 
responsibilities concerning the allocation and registration of IP addresses formerly 
performed by the U.S. government. 

d. ARIN has specific processes and policies that must be followed and met 
before an IP address can be assigned or transferred. These policies are developed by 
the internet community ARIN serves. In order for an organization to request 
registration rights to internet number resources, it must submit a request to ARIN, 
provide documentation showing need for the requested resources in accordance with 
ARIN policies, and enter into a registration services agreement (RSA) with ARIN. 
ARIN currently has more than 23,000 RSAs with organizations on file, such as Internet 
service providers, wireless phone companies, universities, government agencies, 
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financial institutions, insurance companies, and smaller companies that require access 
to the internet. 

e. Internet “traffic” is routed through Internet Protocols. The Protocols 
utilize an address, familiar to most Internet users as a series of decimal numbers 
separated by periods. The Internet Protocol has gone through several versions, most 
recently versions four (IPv4) and six (IPv6). IPv4 was depleted at a rate not initially 
anticipated in the original design of the address system. As a result, a long-term 
solution was created in the form of IPv6, which provides a vastly increased address 
space. However, communication between the two systems is not universal, and IPv6 
alone does not provide and immediate solution to IPv4 exhaustion. Likewise, 
migration to IPv6 will take considerable time. As a result, there remains a demand for 
IPv4 addresses, despite the solution IPv6 constitutes to IPv4 address exhaustion. 

f. In early 2011, the IANA global IPv4 pool was exhausted, though ARIN 
still had its own free pool of IPv4 addresses available to issue. Given the demand for 
IPv4 addresses, ARIN often required justification and customer identification for 
additional IPv4 address blocks, in an effort to verify that the IPv4 request was valid. 
Further, IPv4 addresses are transferrable between entities, and these transfers must also 
be approved by ARIN. 

g. As a result of the demand for IPv4 addresses, and the ability to transfer 
the addresses between entities, a secondary market was created for the transfer of 
address blocks. Currently, market rates for an IPv4 address are between $13 and $19. 
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h. MICFO, LLC (MICFO) and Channel Partners were businesses owned and 
operated by AMIR GOLESTAN (GOLESTAN). 

i. MICFO represents itself as providing hosting services, and providing 
customers with the technologies and services needed for a website or webpage to be 
viewed on the Internet. MICFO further represents itself as a business that requires IP 
addresses that it provides to its customers. 

j. From between February 2014 and the time of this indictment, AMIR 
GOLESTAN and MICFO created and utilized Channel Partners, which purported to 
consist of several individual businesses, all of whom purportedly required IP addresses 
from ARIN. These entities would apply directly to ARIN for the IP addresses, 
completing any necessary paperwork, including identifying officers with the 
businesses and corresponding through business employees with ARIN in the process 
of requesting and obtaining IP addresses. 

THE SCHEME TO DEFRAUD 

2. From in or around February 2014 and continuing until the time of this 
Indictment, in the District of South Carolina, and elsewhere, the defendants, AMIR 
GOLESTAN and MICFO, LLC, knowingly did devise and intend to devise a scheme 
and artifice to defraud and to obtain property by means of false and fraudulent 
pretenses, representations, and promises, by misrepresenting to ARIN that certain 
companies were run by particular individuals, and that those individuals existed, when 
in fact those individuals were aliases for GOLESTAN and did not, in fact, exist. 
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3. It was part of the scheme that GOLESTAN used Channel Partner 
component companies to apply to ARIN for IP addresses. When applying to ARIN for 
IP addresses, the particular businesses would represent particular aspects about the 
company, for instance who the officers were, information regarding Secretary of State 
registration, and sworn affidavits representing facts about the business. The 
information GOLESTAN provided regarding Channel Partners was not accurate 
however. In fact, the individuals purported to be officers for Channel Partners were 
fabricated by GOLESTAN and were in fact aliases for GOLESTAN himself, or others 
working for him or MICFO. 

4. It was part of the scheme that GOLESTAN would create web pages and 
email addresses for these fictitious individuals in an effort to make it appear that these 
individuals ran the particular companies. 

5. It was part of the scheme that GOLESTAN provided, or caused to be 
provided, false statements and documents to ARIN, using the identities of these 
fictitious individuals, and obtained IP addresses as a result of these fraudulent 
representations. 


6. It was part of the scheme that GOLESTAN created and used the following 
companies, or “Channel Partners,” and corresponding false identities, among others: 



Company 

Fabricated Individual 

a. 

Contina 

John Lieberman 

b. 

Virtuzo 

Jeff Farber / Mark Schmidt 

c. 

Oppobox 

Kevin Chang 
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d. 

Telentia 

Yong Wook-Kwon 

e. 

Univera Network / 
HostAware 

Steve Cunningham 

f. 

Roya Hosting 

Brian Sherman 

g- 

Host Bang 

Ahmad A1 Bandi 

h. 

Hyper VPN 

Sebatian Buszewski 

i. 

Fiber Galaxy 

Pooya Torabi 

j- 

Cloudiac 

Paul Lampert 


7. Through this scheme to defraud GOLESTAN obtained approximately 
757,760 IPv4 addresses from ARIN. The market value of these IP addresses is between 
$9,850,880.00 and $14,397,440.00. 

8. In 2017 and 2018 GOLESTAN sold, and attempted to sell, IP addresses 
he had fraudulently obtained the rights to. Using a third party broker, GOLESTAN 
sold 65,536 IPv4 addresses for $13.00 each, for a total of $851,896.00. GOLESTAN 
also organized a second transaction for another 65,536 IP addresses, for another 
approximately $1,000,000.00. During this same time period, GOLESTAN had a 
contract to sell 327,680 IP addresses at $19.00 per address, for a total of $6,225,910.00, 
with half of these addresses consisting of Channel Partner addresses obtained 
fraudulently. However, ARIN became aware of GOLESTAN’s fraud at that time and 
was able to prevent the transaction from going through. 

9. On or about the dates set forth below, in the District of South Carolina 
and elsewhere, AMIR GOLESTAN and MICFO, for the purpose of executing the 
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above-described scheme and artifice, and attempting to do so, did transmit and cause 
to be transmitted by means of wire communication in interstate and foreign commerce, 
the writings, signs and signals, as further described below, on or about the dates 
specified: 


Count 

On or about 

Description of Wire Transaction or 
Communication 

1 . 

September 19, 2014 

Oppobox Officer Attestation signed by “Kevin 
Chang” 

2. 

May 14, 2015 

Allocation to Oppobox of rights to approximately 
16,000 IP addresses 

3. 

April 13,2018 

HostAware Officer Attestation signed by “Steven 
Cunningham” 

4. 

June 24, 2015 

Allocation to Univera / HostAware of rights to 
approximately 16,000 IP addresses 

5. 

June 30, 2014 

RoyaHosting Officer Attestation signed by “Brian 

Sherman” 

6. 

June 18,2015 

Allocation to RoyaHosting of rights to 
approximately 32,000 IP addresses 

7. 

July 29, 2016 

Virtuzo Officer Attestation signed by “Mark 
Schmidt” 

8. 

June 24, 2015 

Allocation to Virtuzo of rights to approximately 
16,000 IP addresses 

9. 

July 14, 2017 

Contina Officer Attestation signed by “Jonathan 
Lieberman” 

10. 

December 19, 2016 

Allocation to Contina of rights to approximately 
64,000 IP addresses 

11. 

May 26, 2015 

Fiber Galaxy Officer Attestation signed by “Pooya 

Torabi” 

12. 

February 21, 2017 

Allocation to Fiber Galaxy of rights to 
approximately 8,000 IP addresses 

13. 

June 5, 2015 

Telentia Data Certification signed by “Yong Wook- 

Kwon” 

14. 

June 12, 2015 

Allocation to Telentia of approximately 16,000 IP 

addresses 

15. 

December 29, 2014 

Border Technology / Cloudiac Officer Attestation 
signed by “Paul Lamperf ’ 

16. 

May 11,2015 

Allocation to Cloudiac of approximately 8,000 IP 

addresses 


7 





















2:19-cr-00441-CRI Date Filed 05/14/19 Entry Number 2 Page 8 of 11 


17. 

June 21, 2015 

Fairway Network / HyperVPN Officer Attestation 
signed by “Sebastian Buszewski” 

18. 

February 21, 2017 

Allocation to Fairway Network / HyperVPN of 
approximately 8,000 IP addresses 

19. 

May 31,2015 

Queen Systems / Hostbang Officer Attestation 
signed by “Ahmad A1 Bandi” 

20. 

June 22, 2015 

Allocation to Ilostbang of approximately 256 IP 
addresses 


In violation of Title 18, United States Code, Section 1343. 
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FORFEITURE 

A. WIRE FRAUD: 

Upon conviction of Title 18, United States Code, Section 1343 as charged in this 
Indictment, the Defendants, AMIR GOLESTAN and MICFO, LLC shall forfeit to the 
United States, any property, real or personal, constituting, derived from or traceable to 
proceeds the Defendant obtained directly or indirectly as a result of such offenses and any 
property. 

B. PROPERTY: 

The property subject to forfeiture includes, but is not limited to, the following: 


1. Forfeiture Judgment: 


A sum of money equal to all proceeds the Defendants obtained directly or 
indirectly as a result of the offenses charged in this Indictment, in an amount to be 
determined equal to all proceeds derived from the offense, and all interest and 
proceeds traceable thereto as the result of the violations of 18 U.S.C. §1343. 

2. IP Number Resources: 


IP Block 

Entity 

Number of IP addresses 

104.166.96.0/19 

OppoBox 

8,192 

104.247.96.0/19 

OppoBox 

8,192 

104.250.224.0/19 

OppoBox 

8,192 

172.98.0.0/18 

Telentia 

16,384 

174.136.192.0/18 

Telentia 

16,384 

45.41.0.0/18 

OppoBox 

16,384 

45.41.192.0/18 

OppoBox 

16,384 

45.59.128.0/18 

OppoBox 

16,384 

104.167.192.0/18 

OppoBox 

16,384 

104.224.0.0/18 

OppoBox 

16,384 

104.249.128.0/18 

OppoBox 

16,384 

155.254.192.0/18 

OppoBox 

16,384 

172.110.128.0/18 

OppoBox 

16,384 

172.111.0.0/18 

OppoBox 

16,384 

169.197.128.0/18 

Border Technology 

16,384 

172.81.0.0/18 

Border Technology 

16,384 
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107.181.64.0/20 

Contina 

4,096 

167.160.96.0/19 

Contina 

8,192 

209.161.96.0/20 

Telentia 

4,096 

104.128.16.0/20 

Telentia 

4,096 

104.143.192.0/19 

Telentia 

8,192 

104.222.192.0/19 

Telentia 

8,192 

104.247.0.0/19 

Telentia 

8,192 

107.190.160.0/20 

OppoBox 

4,096 

107.182.112.0/20 

OppoBox 

4,096 

104.207.64.0/19 

OppoBox 

8,192 

155.254.96.0/19 

OppoBox 

8,192 

167.88.96.0/20 

Virtuzo 

4,096 

104.128.128.0/20 

Virtuzo 

4,096 

104.156.192.0/19 

Virtuzo 

8,192 

104.222.128.0/19 

Virtuzo 

8,192 

104.143.16.0/20 

Roya 

4,096 

104.237.80.0/20 

Univera Network 

4,096 

45.62.32.0/19 

Univera Network 

8,192 

45.61.32.0/20 

Border Technology 

4,096 

173.44.0.0/19 

Border Technology 

8,192 

172.97.80.0/20 

Fiber Galaxy 

4,096 

206.223.224.0/19 

Fiber Galaxy 

8,192 

172.102.128.0/20 

Queen Systems 

4,096 

209.209.224.0/19 

Queen Systems 

8,192 

172.110.208.0/20 

Fairway Network 

4,096 

207.189.0.0/19 

Fairway Network 

8,192 


C. SUBSTITUTION OF ASSETS: 


If any of the property described above as being subject to forfeiture, as a result of 
any act or omission of the defendants: 

(a) cannot be located upon the exercise of due diligence; 

(b) has been transferred or sold to, or deposited with, a third person; 

(c) has been placed beyond the jurisdiction of the Court; 

(d) has been substantially diminished in value; or 

(e) has been commingled with other property which cannot be subdivided 
without difficulty; 
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it is the intent of the United States, pursuant to Title 21, United States Code, Section 853 (p), 
as incorporated by 18 U.S.C. § 982(b)(1) to seek forfeiture of any other property of 
Defendant up to an amount equivalent to the value of the above-described forfeitable 
property; 

Pursuant to Title 18, United States Code, Section 981(a)(1)(C) and Title 28, United 
States Code, Section 2461(c). 



UNITED STATES ATTORNEY 


11 






